dicken.ding b84a8aba80 genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() ... irq_find_at_or_after() dereferences the interrupt descriptor which is returned by mt_find() while neither holding sparse_irq_lock nor RCU read lock, which means the descriptor can be freed between mt_find() and the dereference: CPU0 CPU1 desc = mt_find() delayed_free_desc(desc) irq_desc_get_irq(desc) The use-after-free is reported by KASAN: Call trace: irq_get_next_irq+0x58/0x84 show_stat+0x638/0x824 seq_read_iter+0x158/0x4ec proc_reg_read_iter+0x94/0x12c vfs_read+0x1e0/0x2c8 Freed by task 4471: slab_free_freelist_hook+0x174/0x1e0 __kmem_cache_free+0xa4/0x1dc kfree+0x64/0x128 irq_kobj_release+0x28/0x3c kobject_put+0xcc/0x1e0 delayed_free_desc+0x14/0x2c rcu_do_batch+0x214/0x720 Guard the access with a RCU read lock section. Fixes: 721255b982 ("genirq: Use a maple tree for interrupt descriptor management") Signed-off-by: dicken.ding <dicken.ding@mediatek.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240524091739.31611-1-dicken.ding@mediatek.com		2024-05-24 12:49:35 +02:00
..
affinity.c
autoprobe.c
chip.c
cpuhotplug.c	genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline	2024-05-23 21:51:50 +02:00
debug.h
debugfs.c
devres.c
dummychip.c
generic-chip.c
handle.c
internals.h	genirq: Reuse irq_is_nmi()	2024-04-24 20:42:57 +02:00
ipi-mux.c
ipi.c
irq_sim.c	genirq/irq_sim: Shrink code by using <linux/cleanup.h> helpers	2024-01-29 11:07:57 +01:00
irqdesc.c	genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after()	2024-05-24 12:49:35 +02:00
irqdomain.c	irqdomain: Check virq for 0 before use in irq_dispose_mapping()	2024-04-08 12:08:58 +02:00
Kconfig	genirq: Provide a snapshot mechanism for interrupt statistics	2024-04-12 17:08:05 +02:00
Makefile
manage.c	Updates for the interrupt subsystem:	2024-05-14 09:47:14 -07:00
matrix.c	genirq/matrix: Dynamic bitmap allocation	2024-02-23 10:18:44 +01:00
migration.c
msi.c	genirq/msi: Add MSI allocation helper and export MSI functions	2024-04-23 14:27:52 -06:00
pm.c
proc.c	genirq: Avoid summation loops for /proc/interrupts	2024-04-12 17:08:05 +02:00
resend.c	genirq: Reuse irq_is_nmi()	2024-04-24 20:42:57 +02:00
settings.h
spurious.c
timings.c